diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ef7993b..3c4d4e4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,6 +12,10 @@ permissions:
 jobs:
   build-azure-ipoib-ipam-cni:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      actions: read
+      contents: read
     strategy:
       matrix:
         include:
@@ -38,6 +42,20 @@ jobs:
           name: azure-ipoib-ipam-cni-${{ matrix.os }}-${{ matrix.arch }}
           path: bin/azure-ipoib-ipam-cni-${{ matrix.os }}-${{ matrix.arch }}
           if-no-files-found: error
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ matrix.platforms }}
+          push: true
+          tags: ghcr.io/azure/azure-ipoib-ipam-cni:${{ matrix.os }}-${{ matrix.arch }}
   publish:
       runs-on: ubuntu-latest
       needs:
@@ -54,4 +72,4 @@ jobs:
           uses: softprops/action-gh-release@v1 # v1
           with:
             files: |
-              ./artifacts/azure-ipoib-ipam-cni-*-*/*
\ No newline at end of file
+              ./artifacts/azure-ipoib-ipam-cni-*-*/*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c30be34
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,9 @@
+FROM golang as builder
+
+COPY . /workspace/
+WORKDIR /workspace/
+RUN make build
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=builder /workspace/bin/* /
+ENTRYPOINT ["/install"]
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 945cc5a..805abd9 100644
--- a/Makefile
+++ b/Makefile
@@ -45,8 +45,9 @@ vet: golangci-lint ## Run go vet against code.
 ##@ Build
 
 .PHONY: build
-build: $(LOCALBIN) fmt vet ## Build manager binary.
+build: clean $(LOCALBIN) fmt vet ## Build manager binary.
 	CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -o bin/azure-ipoib-ipam-cni ./cmd/
+	CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -o bin/install ./cmd/install
 ##@ Build Dependencies
 
 .PHONY: install-dependencies
@@ -75,4 +76,8 @@ GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint
 .PHONY: golangci-lint 
 golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
 $(GOLANGCI_LINT): $(LOCALBIN)
-	test -s $(LOCALBIN)/golangci-lint || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(LOCALBIN) latest
\ No newline at end of file
+	test -s $(LOCALBIN)/golangci-lint || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(LOCALBIN) latest
+
+.PHONY: clean
+clean: 
+	rm -rf $(LOCALBIN)
\ No newline at end of file
diff --git a/cmd/install/main.go b/cmd/install/main.go
new file mode 100644
index 0000000..9f0b397
--- /dev/null
+++ b/cmd/install/main.go
@@ -0,0 +1,20 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	content, err := os.ReadFile("azure-ipoib-ipam-cni")
+	if err != nil {
+		fmt.Printf("failed to find file: %s", err.Error())
+		os.Exit(1)
+	}
+	if err := os.WriteFile("/opt/cni/bin/azure-ipoib-ipam-cni", content, 0755); err != nil {
+		fmt.Printf("failed to write file: %s", err.Error())
+		os.Exit(1)
+	}
+}